VDB

CVE-2026-18608

CVE-2026-18608 PUBLISHED CVSS 8.7 HIGH

Reported by redhat · Published August 10, 2026

A flaw was found in the Data Science Pipelines Operator (DSPO). The operator's ClusterRole, which defines its permissions, includes extensive privileges beyond what is necessary for its operation. These excessive permissions, such as the ability to execute commands within pods and manage cluster-wide roles, could be exploited. If the DSPO pod were compromised, an attacker could leverage these privileges to gain full administrative control over the entire Kubernetes cluster.

Risk Scores

CVSS 3.1
8.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Affected Products

VendorProductVersions
Red HatRed Hat OpenShift AI 2.251785189332
Red HatRed Hat OpenShift AI 2.251788182334
Red HatRed Hat OpenShift AI 3.31785187936
Red HatRed Hat OpenShift AI 3.41784833428
Red HatRed Hat OpenShift AI 3.41787002057
Red HatRed Hat OpenShift AI 3.51786552271
Red HatRed Hat OpenShift AI 3.51786552250
Red HatRed Hat OpenShift AI 3.41784833428, 1787002057, 1784833428
Red HatRed Hat OpenShift AI 3.51786552250
Red HatRed Hat OpenShift AI 2.251785189332, 1788182334, 1785189332
Red HatRed Hat OpenShift AI 3.51786552271
Red HatRed Hat OpenShift AI 3.31785187936, 1785187936, 1785187936
Red HatRed Hat OpenShift AI (RHOAI)

Timeline

  • Aug 10, 2026 CVE Published
  • Aug 11, 2026 Coalition ESS Score
  • Aug 24, 2026 EPSS Score
  • Aug 26, 2026 EPSS Score
  • Aug 28, 2026 EPSS Score
  • Aug 30, 2026 EPSS Score
  • Sep 3, 2026 EPSS Score
  • Sep 6, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score
  • Sep 18, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›